CoinMiner Being Installed on Vulnerable Apache Tomcat Web Server
The ASEC analysis team has recently identified attacks targeting vulnerable Apache Tomcat web server. The Tomcat server that has not been updated to the latest version is one of the major attack vectors that exploit vulnerabilities. In the past, the ASEC blog has also covered attacks targeting Apache Tomcat servers
Caution! Microsoft Office Zero-day Vulnerability Follina (CVE-2022-30190)
A new vulnerability named Follina (CVE-2022-30190) has been revealed. According to Microsoft, it is a remote code execution vulnerability that occurs when the URL protocol is used to call MSDT in calling applications such as Microsoft Word. With the privileges of the calling application, attackers can run arbitrary codes, install additional
Distribution of Remcos RAT Disguised as Tax Invoice
The ASEC analysis team has discovered Remcos RAT being distributed under the disguise of a tax invoice. The content and the type of phishing email are similar to the type that has been consistently discussed in previous blogs. Within the email, it has a short message written in awkward grammar.
![[Announcement] New Log4j Vulnerability (CVE-2021-45105) – Log4j 2.17.0](https://asec.ahnlab.com/wp-content/uploads/2021/12/39_cyber-security_02.png)
[Announcement] New Log4j Vulnerability (CVE-2021-45105) – Log4j 2.17.0
CVE-2021-45105 vulnerability that operates in Log4j 2.16.0 version was additionally revealed on December 18th, 2021 (CVSS 7.5). 1. Vulnerable Versions Log4j 2.0-beta9 to 2.16.0 2. Vulnerability Exploitation Technique Vulnerability exploitations may occur if applications that use Log4j are enabled with the layout pattern and thread context features. The following shows
![[Notice] Log4j Core Affected by Apache Log4j Vulnerability CVE-2021-44228](https://asec.ahnlab.com/wp-content/uploads/2021/12/38_security-alert_01.png)
[Notice] Log4j Core Affected by Apache Log4j Vulnerability CVE-2021-44228
AhnLab recommends security updates for Apache Log4j vulnerability. Apache Log4j Vulnerability Information Vulnerability Vulnerability (CVE-2021-44228, CVSS 10.0) that the attacker can remote code execute via a log message in Log4j 2.x version [1] Vulnerability (CVE-2021-45046, CVSS 3.7) in Log4j 2.x version that allows the attacker to cause Denied of Service
North Korea-related Malicious Document Files Using CVE-2021-40444 Vulnerability
The ASEC analysis team has recently discovered the distribution of malicious files that include a new vulnerability CVE-2021-40444 which was revealed by Microsoft in September. It is noteworthy that the confirmed document files are all North Korea-related materials. North Korea-related malicious files have been evolving in new ways since the past. Seeing
RTF Malware Disguised as a Cover Letter for a Particular Airline
In early October, the ASEC analysis team has discovered an RTF file-based malware disguised as a cover letter for a particular airline. This is not a type of document file format that appears often as other document-type malware (Word, Excel, etc.), and RTF malware disguised as a particular document hasn’t
Forensic Analysis of Breaches that Used Cobalt Strike and MS Exchange Server Vulnerability
The ASEC analysis team is consistently monitoring the activities of Cobalt Strike, one of the trending cybersecurity issues that were discussed in previous blog posts regarding its distribution to Korean companies. (The link to a previous blog post can be found at the bottom of this post.) While monitoring Cobalt
